Attackers in Binance Breach Targeted Known Weakness, Missing Controls
Blockchain complexities, such as attacker-deployed sweepers, hobble security controls designed to limit the damage of an exchange compromise.
On Oct. 29, cyber thieves transferred around $6.34 billion in various cryptocurrencies from at least 11 wallets owned by exchange Binance to attacker-controlled addresses. Binance seemingly had not put in place security controls to quickly detect malicious authorizations and disable them through a pretested kill switch, experts say — which should put other crypto firms on notice.
While Binance’s internal security systems issued an alert in minutes, the attackers exploited a feature of Ethereum smart accounts — a relatively new type of account abstraction introduced to Ethereum with the EIP-7702 proposal in 2025 — to essentially install malicious code, known as a “sweeper.” The sweeper code transferred all the funds held in a primary treasury wallet at Binance — consisting of more than five dozen cryptocurrencies totaling approximately $2.5 billion — to the attacker’s address created minutes before.
In the end, the wallet was left with a single ETH coin, according to an analysis by blockchain security firm BlockAid.
Large transactions from other wallets to the same address, initiated by the attackers, triggered internal alerts at Binance. The company took countermeasures, but the smart-account authorization continued to function for about four hours, siphoning additional funds.
“An EIP-7702 authorization [is] a standing delegation,” says Ido Ben-Natan, co-founder and CEO of BlockAid. “Once it is on-chain, attacker-controlled code can move that hot wallet’s funds, and anything later deposited to it, until the same wallet … [revokes the authorization]. It carries no amount and no destination, so withdrawal controls never see it.”
Despite a sweeper function enabled through EIP-7702 authorization being a known threat, Binance noted in a Nov. 3 post-mortem report that the authorization hobbled the companies efforts to stop transactions from flowing out onto the blockchain.
“Once established, these authorizations enabled the attackers to continue moving assets independently of Binance’s normal withdrawal infrastructure,” the company stated in a post-mortem report. “Binance needed additional transactions to revoke these on-chain authorizations … suspending withdrawals and shutting down hot wallet services did not automatically invalidate existing on-chain authorizations.”
A Primary Control: Protect & Educate Developers
Developers were the initial weak point, enabling the EIP-7702 authorization attack to occur. One developer downloaded a compromised version of Homebrew, an open source package management tool for Macs, while a second developer fell for a fake job interview, during which they were given a software “assignment” that compromised his system, according to Binance’s post-mortem.
In the end, the attackers used their compromise of the two developers’ systems — as well as a third developer’s system — to gain signing privileges, creating 50 presigned authorizations to flood the targeted wallet, known among blockchain analysts as “Binance 14,” at the right time.
The same targeting of developers happened during the ByBit Ethereum heist on Feb. 21, 2025, says Avi Sambira, vice president of North America at incident-response firm Sygnia. In that case, cyber thieves compromised the Mac of a Safe{Wallet} developer nearly three weeks before the actual theft, according to Sygnia’s analysis of that incident. Safe{Wallet} is used by Ethereum and other decentralized autonomous organizations (DAOs) to enforce multisignature security.
“[A]n AWS token was used and attackers operated inside Safe{Wallet}’s cloud environment for roughly two weeks before modifying the signing interface,” Sambira says. “Binance’s disclosure appears consistent with the same model, with initial reporting indicating endpoint and internal-tool compromise preceded credential, token, and[/or] container access to wallet signing.”
Like that incident, the FBI placed blame directly on North Korean cybercriminal operators, releasing a list of more than 600 Ethereum addresses, 19 Bitcoin addresses, and 1 SOL address linked to TraderTraitor, a moniker for the group behind the attacks.
Exchanges and crypto-finance firms need to treat their developers, vendors, and suppliers as critical elements of their infrastructure. Attackers are increasingly looking to compromise developer identities, repositories, CI/CD pipelines, cloud control planes, and third-party integrations, Sambira says. Those assets sit only one or two trust boundaries away from withdrawal authority.
“TraderTraitor’s evolution is less about abandoning old techniques than combining them into a more sophisticated trust attack,” he says. “Fake recruiters and malicious coding assignments establish the foothold, [while] stolen sessions, cloud credentials, and trusted interfaces turn that foothold into transaction control.”
Look Out for Suspicious Transactions — and Authorizations
When the cyberattackers used their pregenerated authorizations, they sent 50 at the same time because every transaction needs a valid nonce — a sequential counter — so the attackers used a window of 50 authorizations and needed only a single one to match.
The nonce spray to install a malicious sweeper is a new, but known, threat. In a paper presented at the USENIX Security conference in August, researchers from Hong Kong University of Science and Technology and two other Chinese schools revealed that at least 924 malicious smart contracts had been enabled through the EIP-7702 mechanism, leading to at least $2.3 million in losses.
In its own research, BlockAid saw at least $1.1 million in losses across four instances. It predicted that the first 10-figure attack would arrive before the end of 2026. The firm was off by a factor of 100.
The attacks can be stopped — or at least blunted — by a combination of controls. Any company processing cryptocurrency transactions in real time should use simulations to detect malicious rules, enforce policies on the allowed size of transactions and their destinations, issue alerts based on detecting a burst of large transactions, and deploy a fast kill switch that has been prebuilt to pause signing and stop wallet refills, says BlockAid’s Ben-Natan.
Binance seemingly had none — or only some — of those controls in place. In the end, it took nearly four hours — the attack started at 20:05 UTC and the last transaction was recorded at 23:56 UTC — for the company to stop transactions from being recorded on the blockchain, subsequently freezing and recovering about $2.85 billion in attempted stolen assets. The company did not respond to requests for comment.
Binance highlights the importance of having good monitoring and the ability to detect anomalous transactions.
The difficulty in responding to the attacks underscores the problems that cryptocurrency exchanges and infrastructure firms face to combat theft and fraud. In many ways, Binance had created an overlapping set of controls to detect attacks and block transfers in near real time. However, the state-sponsored attackers found a way to bypass those controls through the EIP-7702 sweeper.
The pressure on cryptocurrency firms will only rise because attackers can exfiltrate the funds quickly, says Ari Redbord, global head of policy at TRM Labs and a former federal prosecutor and US Treasury official.
“For years we’ve seen hacks against large financial institutions, tech companies, and even government agencies — the difference is that in crypto you can steal funds in real time,” he says. “There’s no clawback window, and the money is gone in minutes.”
Controls Are Not Enough
Crypto-finance firms need to have visibility across four domains: identity and authority governance, infrastructure and execution integrity, custody and transaction authorization, and on- and off-chain detection, says Sygnia’s Sambira. Companies that only monitor transactions on the blockchain are seeing changes too late, he adds.
In addition, crypto firms should rigorously track all identities and systems that can initiate, approve, modify, or execute transactions and be ready to suspend those accounts’ privileges, he says.
“Controls with the greatest containment value involve the preauthorized ability to revoke identities and tokens, pause transfers, isolate wallets, and rebuild affected infrastructure within minutes,” Sambira says. “Those capabilities must be tested before a crisis hits and retested regularly.”
Testing and practicing these controls are critical because companies need to know that they will work in real time, says TRM Labs’ Redbord.
“The actionable part for any company touching crypto is that these patterns are recognizable. If you watch in real time, you can act in the first moments, when it matters most,” he says. “This is all about speed.”
Monitoring transactions can detect suspicious activity quite quickly and, in the case of the cryptocurrency thefts targeting Binance and ByBit, can stop attacks before too much value is lost. The keys to adequate responses are speed and relationships to the various stakeholders, says Redbord.
“Issuers like Tether and Circle can freeze the addresses holding stolen tokens and then burn those tokens and reissue the same amount to the rightful owner,” he says. “The funds don’t have to be chased down. They can be made whole on-chain.”
Nearly all issuers, exchanges, blockchain intelligence firms, and many global law enforcement agencies are part of the Beacon Network, created by TRM Labs and other industry players, for early detection of and intelligence sharing about cryptocurrency incidents. In addition, cryptocurrency-reliant businesses should ensure that any exchange with which they do business has withdrawal limits and allowlists, isolates their signing systems on computers reserved for that purpose, and constantly trains their engineers against social engineering, Redbord says.
Organizations should also reduce measures of time to detect, time to contain, and time to freeze to seconds. The approval of major transactions should require multiple signatures from systems that are used for only that purpose, and businesses need to have a response plan that keeps them operational while they recover.
Binance has taken some of these steps, including identifying the affected systems, cleaning or replacing them, and replacing wallets, it stated in its initial incident report. It has also completed “enhanced” security scans across employee devices, rotated credentials, and deployed enhanced AI-based behavioral anomaly detection, the company stated.
“There are a number of security measures we have implemented and are implementing that will remain private to prevent malicious actors from compromising our security,” the company stated.
Read more about:
Originally published on Dark Reading
